3 ms·
i think you're actually agreeing. what one of you is calling a key the other calls a no[u]nce. the implicit (worse) alternative is that you encrypt or sign ad
by andrewcooke 14y ago
i think you're actually agreeing. what one of you is calling a key the other calls a no[u]nce.
the implicit (worse) alternative is that you encrypt or sign additional state in the url (and in this case, base64 was the "encryption").
- pyre 14y agoI realize that key == nonce in my post. My point was against the statement "emailing password reset links is bad and not best practice." You need an password link to make use of the key/nonce. The point of the nonce isn't to eliminate links. It's to make the attack surface that much smaller by limiting their power.